PostgreSQL versions 10.x before 10.9 and versions 11.x before 11.4 are vulnerable to a stack-based buffer overflow. Any authenticated user can overflow a stack-based buffer by changing the user's own password to a purpose-crafted value. This often suffices to execute arbitrary code as the PostgreSQL operating system account.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresql15Upgrade postgresqlUpgrade postgresql14 | Jul 5, 2019 | Jun 26, 2019 |
| Centos_linux | — | Upgrade postgresql-serverUpgrade postgresql-plperlUpgrade postgresql-contribUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-pltclUpgrade postgresql-server-develUpgrade postgresql-plperl-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-test-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-testUpgrade postgresql-upgrade-develUpgrade postgresql-debugsourceUpgrade postgresql-staticUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresqlUpgrade postgresql-docs | Sep 9, 2020 | Jun 26, 2019 |
| Freebsd | — | Upgrade postgresql11-serverUpgrade postgresql10-server | Jun 27, 2019 | Jun 27, 2019 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Mar 13, 2020 | Jun 26, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-contribUpgrade postgresql-plpythonUpgrade postgresql-develUpgrade postgresql-pltclUpgrade postgresql-plperlUpgrade postgresql-testUpgrade postgresql-serverUpgrade postgresql-docsUpgrade postgresql-libsUpgrade postgresql | Aug 28, 2019 | Jun 26, 2019 |
| Oracle_linux | — | Upgrade postgresql-docsUpgrade rh-postgresql10-postgresql-testUpgrade rh-postgresql10-postgresql-docsUpgrade postgresql-upgrade-develUpgrade postgresql-staticUpgrade rh-postgresql10-postgresql-syspathsUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade rh-postgresql10-postgresqlUpgrade rh-postgresql10-postgresql-develUpgrade rh-postgresql10-postgresql-libsUpgrade postgresql-upgradeUpgrade postgresql-plpython3Upgrade rh-postgresql10-postgresql-staticUpgrade postgresql-test-rpm-macrosUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade postgresql-pltclUpgrade postgresqlUpgrade postgresql-contribUpgrade postgresql-serverUpgrade rh-postgresql10-postgresql-contribUpgrade postgresql-plperlUpgrade postgresql-server-develUpgrade rh-postgresql10-postgresql-plperlUpgrade postgresql-testUpgrade rh-postgresql10-postgresql-pltclUpgrade rh-postgresql10-postgresql-serverUpgrade rh-postgresql10-postgresql-plpython | Sep 10, 2020 | Jun 20, 2019 |
| Postgres | — | Upgrade to PostgreSQL version 11.4 | Jun 21, 2019 | Jun 21, 2019 |
| Redhat_linux | — | Upgrade postgresql-serverUpgrade postgresql-test-debuginfoUpgrade postgresql-plperlUpgrade postgresql-testUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-plpython3-debuginfoUpgrade postgresql-pltclUpgrade postgresql-debugsourceUpgrade postgresql-upgradeUpgrade postgresql-docs-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-staticUpgrade postgresql-server-develUpgrade postgresql-upgrade-develUpgrade postgresql-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-server-debuginfoUpgrade postgresql-docsUpgrade postgresql-contribUpgrade postgresql | Sep 9, 2020 | Jun 26, 2019 |
| Suse | — | Upgrade postgresql12-plpythonUpgrade postgresql12-pltclUpgrade postgresqlUpgrade postgresql12-develUpgrade postgresql-docsUpgrade postgresql12-docsUpgrade postgresql12-server-develUpgrade postgresql12-contribUpgrade postgresql10-serverUpgrade postgresql10-testUpgrade postgresql12-serverUpgrade libpq5-32bitUpgrade libecpg6-32bitUpgrade postgresql10-plperlUpgrade postgresql-serverUpgrade postgresql-pltclUpgrade postgresql10-contribUpgrade python3-psycopg2Upgrade postgresql-plpythonUpgrade postgresql10-docsUpgrade libpq5Upgrade postgresql10-develUpgrade postgresql10-pltclUpgrade postgresql10Upgrade postgresql12-plperlUpgrade postgresql-contribUpgrade postgresql10-plpythonUpgrade libecpg6Upgrade postgresql12Upgrade postgresql-develUpgrade postgresql-plperlUpgrade postgresql-server-devel | Jul 10, 2019 | Jun 20, 2019 |
| Ubuntu | — | Upgrade postgresql-10Upgrade postgresql-11 | Jun 21, 2019 | Jun 20, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 26, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub